9.8crit
CVE-2017-7540
Safemode Gem Has Incomplete List of Disallowed Inputs
Also known as GHSA-5vx5-9q73-wgp4
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Exploit prediction (EPSS)
1.63% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | safemode | <1.3.2 | 1.3.2 |
Affected products
- Red Hat, Inc. rubygem-safemode
Classification
- Weakness
- CWE-184 Incomplete List of Disallowed Inputs
References
- github.com /svenfuchs/safemode/pull/23 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7540 · advisory
- github.com /rubysec/ruby-advisory-db/blob/master/gems/safemode/CVE-2017-7540.yml · web
- github.com /svenfuchs/safemode · package
Sources
- CVE List: CVE-2017-7540
- GitHub Advisory: GHSA-5vx5-9q73-wgp4
- NVD: CVE-2017-7540
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.